For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

wgranada's avatar
wgranada
Icon for Altostratus rankAltostratus
Mar 31, 2025

How to find when a user account was created

Good day all, I am new to F5 so apologies for all the silly questions, I have a question about user accounts.  I have 2 Big-IP F5s running in tenant configuration, both running 17.1.2.1.  I was look...
security
david598ball's avatar
david598ball
Icon for Nimbostratus rankNimbostratus
Apr 01, 2025

Hello,
To verify unknown user accounts on Big-IP F5 systems, check /var/log/secure for authentication logs and /config/bigip_user.conf for user account details. If these accounts are not tied to system processes or critical configurations, deleting them should only affect their ability to log in. Ensure you have backups and consult your organization's security policy before proceeding. 

Best Regards,
David Ball

  • wgranada's avatar
    wgranada
    Icon for Altostratus rankAltostratus
    Apr 03, 2025

    Hi David

    I checked those and all I see is myself, the  /config/bigip_user.conf show those accounts configured but nothing more.  These accounts where here prior to me coming on board so just wanted to make sure this was just a regular user account before I delete it.  I know the defaults are Root and Adim, I see those there.

     

    Thank you 

    Warren